A New Twist in Ransomware Command-and-Control

The group behind Chaos ransomware has adopted a malware tool called msaRAT that takes an unusual approach to staying hidden on infected machines. Instead of having its malicious process talk directly to a remote server, the way most malware does, msaRAT hands that job off to a legitimate browser. It launches a headless (invisible, GUI-less) instance of Chrome or Microsoft Edge, controls it through the Chrome DevTools Protocol (CDP), and lets the browser handle all outbound communication. The msaRAT process itself never touches the network directly; it stays confined to loopback, meaning it only talks to the browser instance running on the same machine.

This matters because it inverts the usual detection logic security tools rely on. Analysts and automated defenses typically flag suspicious processes that reach out to unfamiliar external IP addresses. With msaRAT, the process doing the reaching out is a real, signed browser binary, and the traffic it generates is dressed up to look like something ordinary.

Why Routing Through Twilio TURN Matters for Privacy

The browser instance msaRAT controls doesn't connect to a plain command-and-control server either. It relays its encrypted traffic through Twilio's TURN infrastructure, a service normally used to help WebRTC connections traverse firewalls and NAT for things like video calls and voice chat. Because TURN relay traffic is encrypted and structurally identical to legitimate WebRTC sessions, it blends into the kind of network activity that billions of browser-based calls and conferencing tools generate every day.

This is the core privacy and security implication of the technique: it exploits the same protocols and services that protect everyday communications to instead protect malicious ones. Network defenders who look for anomalous protocols, unusual destination domains, or unencrypted beacon traffic will find none of those signals here. The traffic pattern looks like a video call, not a ransomware operator checking in with an infected endpoint.

This approach also reflects a broader trend among ransomware and extortion operators toward "living off the browser," an evolution of the older "living off the land" strategy where attackers use legitimate system tools already present on a machine instead of dropping obvious malicious binaries. Ransomware groups have consistently shown a preference for techniques that let them dwell in networks longer before detonating an encryption payload or, increasingly, pivoting to pure data-theft extortion. That extortion model has become common enough that groups regularly claim victims publicly, as seen in cases like the ShinyHunters claims against Exact Sciences, where stolen health data was used as leverage rather than, or in addition to, file encryption.

What This Means For You

For most individual users, msaRAT itself is not something you'll encounter directly, it's a tool aimed at organizations that Chaos ransomware operators are actively targeting for network intrusion and extortion. But the underlying lesson applies broadly: attackers are getting better at making malicious traffic indistinguishable from normal, encrypted browser activity. That should recalibrate expectations about what network monitoring alone can catch.

If your organization relies heavily on perimeter traffic inspection to catch compromise, this kind of technique is a reminder that endpoint-level visibility, meaning what processes are actually doing on a machine rather than just what they're sending over the wire, is becoming more important, not less. A headless browser instance quietly launched by another process is a detectable event at the endpoint even when its network traffic looks clean.

For everyday users, the practical takeaway is less about this specific malware and more about the environment it signals. Ransomware groups are continuously refining ways to blend in, and the compromises that eventually lead to encrypted files or leaked personal data usually start with something mundane: a phishing email, a malicious attachment, or a vulnerable exposed service. Vigilance at that initial stage remains the most effective defense against ever encountering something like msaRAT downstream.

Key Takeaways

  • msaRAT, linked to Chaos ransomware, controls headless Chrome or Edge via the Chrome DevTools Protocol rather than communicating with C2 servers directly.
  • The malware relays encrypted command-and-control traffic through Twilio's TURN service, making it resemble legitimate WebRTC traffic like video calls.
  • This technique is designed to defeat traditional network-based detection that looks for unusual outbound connections or unencrypted beaconing.
  • Organizations should pair network monitoring with endpoint visibility, since the browser process itself, and how it was launched, remains a detectable signal even when its traffic looks clean.
  • The broader trend toward stealthier C2 channels underscores why prompt patching, phishing awareness, and strong endpoint monitoring remain essential defenses against ransomware intrusions before they reach the extortion stage.